@@ -, +, @@ Letters --- C4/Letters.pm | 5 ----- Koha/REST/V1/Auth.pm | 7 ++++--- Koha/REST/V1/TwoFactorAuth.pm | 2 ++ api/v1/swagger/paths/auth.yaml | 3 +++ 4 files changed, 9 insertions(+), 8 deletions(-) --- a/C4/Letters.pm +++ a/C4/Letters.pm @@ -1604,11 +1604,6 @@ sub _process_tt { $content = add_tt_filters( $content ); $content = qq|[% USE KohaDates %][% USE Remove_MARC_punctuation %]$content|; - if ( $content =~ m|\[% otp_token %\]| ) { - my $patron = Koha::Patrons->find(C4::Context->userenv->{number}); - $tt_params->{otp_token} = Koha::Auth::TwoFactorAuth->new({patron => $patron})->code; - } - my $output; $template->process( \$content, $tt_params, \$output ) || croak "ERROR PROCESSING TEMPLATE: " . $template->error(); --- a/Koha/REST/V1/Auth.pm +++ a/Koha/REST/V1/Auth.pm @@ -82,7 +82,6 @@ sub under { } if ( $c->req->url->to_abs->path eq '/api/v1/oauth/token' ) { - #|| $c->req->url->to_abs->path eq '/api/v1/auth/send_otp_token' ) { # Requesting a token shouldn't go through the API authenticaction chain $status = 1; } @@ -235,7 +234,10 @@ sub authenticate_api_request { if ( $c->req->url->to_abs->path eq '/api/v1/auth/send_otp_token' ) { $user = Koha::Patrons->find( $session->param('number') ); $cookie_auth = 1; - $pending_auth = 1; + } else { + Koha::Exceptions::Authentication::Required->throw( + error => 'Authentication failure.' + ); } } elsif ($status eq "maintenance") { @@ -271,7 +273,6 @@ sub authenticate_api_request { ( $params->{is_public} and ( C4::Context->preference('RESTPublicAnonymousRequests') or $user) or $params->{is_plugin} ) - or $pending_auth ) { # We do not need any authorization # Check the parameters --- a/Koha/REST/V1/TwoFactorAuth.pm +++ a/Koha/REST/V1/TwoFactorAuth.pm @@ -45,10 +45,12 @@ sub send_otp_token { return try { + my $code = Koha::Auth::TwoFactorAuth->new({patron => $patron})->code; my $letter = C4::Letters::GetPreparedLetter( module => 'members', letter_code => '2FA_OTP_TOKEN', branchcode => $patron->branchcode, + substitute => { otp_token => $code }, tables => { borrowers => $patron->unblessed, } --- a/api/v1/swagger/paths/auth.yaml +++ a/api/v1/swagger/paths/auth.yaml @@ -36,3 +36,6 @@ * `internal_server_error` schema: $ref: "../swagger.yaml#/definitions/error" + x-koha-authorization: + permissions: + catalogue: "1" --